1 1 00:00:00,000 --> 00:00:02,010 Scanning Risks. 2 2 00:00:02,010 --> 00:00:03,930 In this lesson, we're going to talk about some 3 3 00:00:03,930 --> 00:00:06,570 of the risks associated with scanning. 4 4 00:00:06,570 --> 00:00:09,210 Now, I've mentioned this before, but when you scan things, 5 5 00:00:09,210 --> 00:00:11,850 you have a risk that you can actually do harm. 6 6 00:00:11,850 --> 00:00:13,980 For example, if you're scanning some things, 7 7 00:00:13,980 --> 00:00:15,600 you can actually crash the system, 8 8 00:00:15,600 --> 00:00:17,820 because some of those things are exploiting vulnerabilities 9 9 00:00:17,820 --> 00:00:21,210 that could trigger a system reboot or a system reset. 10 10 00:00:21,210 --> 00:00:23,400 Now, where is this really going to be most common? 11 11 00:00:23,400 --> 00:00:25,980 Well, when you're dealing with printers, VoIP phones, 12 12 00:00:25,980 --> 00:00:27,300 or embedded systems. 13 13 00:00:27,300 --> 00:00:29,370 These components can react unpredictably 14 14 00:00:29,370 --> 00:00:30,750 to any type of scanning, 15 15 00:00:30,750 --> 00:00:32,760 and so you really have a lot more chance 16 16 00:00:32,760 --> 00:00:35,340 of resetting those things or causing it to crash 17 17 00:00:35,340 --> 00:00:37,320 when you're doing vulnerability scans. 18 18 00:00:37,320 --> 00:00:39,480 This again is why it is so important for you 19 19 00:00:39,480 --> 00:00:41,370 to really scope your scans properly, 20 20 00:00:41,370 --> 00:00:43,920 and one of the reasons why I put all my VoIP phones 21 21 00:00:43,920 --> 00:00:47,250 on one scope and I put all my embedded systems on another 22 22 00:00:47,250 --> 00:00:49,320 and I put my printers on yet another. 23 23 00:00:49,320 --> 00:00:50,760 That way, I can really tailor 24 24 00:00:50,760 --> 00:00:54,090 what vulnerabilities I'm going to scan against on those devices 25 25 00:00:54,090 --> 00:00:57,120 and I can minimize my risk of crashing those systems. 26 26 00:00:57,120 --> 00:00:58,320 Now, another thing you need to think about 27 27 00:00:58,320 --> 00:00:59,730 when you start dealing with your scans 28 28 00:00:59,730 --> 00:01:02,100 is all these scan results that come back to you. 29 29 00:01:02,100 --> 00:01:03,750 They have a lot of great information 30 30 00:01:03,750 --> 00:01:05,040 and we're going to start looking at those 31 31 00:01:05,040 --> 00:01:06,600 in the next section of the course, 32 32 00:01:06,600 --> 00:01:08,940 but these scan results need to be protected, 33 33 00:01:08,940 --> 00:01:11,370 because they have the keys to the kingdom. 34 34 00:01:11,370 --> 00:01:12,750 When you have those scan results, 35 35 00:01:12,750 --> 00:01:15,300 you know exactly what vulnerabilities you have, 36 36 00:01:15,300 --> 00:01:16,980 and if you let an attacker get those, 37 37 00:01:16,980 --> 00:01:19,470 that gives them a blueprint of exactly how to attack you, 38 38 00:01:19,470 --> 00:01:21,570 so you want to make sure these are protected. 39 39 00:01:21,570 --> 00:01:23,340 Anytime you finish with a scan, 40 40 00:01:23,340 --> 00:01:24,360 you should take those results 41 41 00:01:24,360 --> 00:01:26,550 and you should encrypt them before storing them. 42 42 00:01:26,550 --> 00:01:27,570 You also should place them 43 43 00:01:27,570 --> 00:01:29,670 behind a restrictive access control list 44 44 00:01:29,670 --> 00:01:31,350 to make sure nobody can get into those, 45 45 00:01:31,350 --> 00:01:33,750 except the personnel who need them. 46 46 00:01:33,750 --> 00:01:35,010 Now, when you're doing your scanning, 47 47 00:01:35,010 --> 00:01:36,450 we talked a lot about the fact 48 48 00:01:36,450 --> 00:01:38,730 of the credentialed versus not credentialed. 49 49 00:01:38,730 --> 00:01:40,380 Well, if you're going to use a credentialed scan, 50 50 00:01:40,380 --> 00:01:43,050 you need to have administrator privileges, right? 51 51 00:01:43,050 --> 00:01:44,760 Well, not necessarily. 52 52 00:01:44,760 --> 00:01:47,460 Instead of giving somebody local administrator privileges, 53 53 00:01:47,460 --> 00:01:49,380 you should use a service account. 54 54 00:01:49,380 --> 00:01:51,420 This way, you can conduct your credentialed scans 55 55 00:01:51,420 --> 00:01:54,810 with a service account on those machines across the network, 56 56 00:01:54,810 --> 00:01:56,220 and if you need to change the password, 57 57 00:01:56,220 --> 00:01:57,690 it's just one service account 58 58 00:01:57,690 --> 00:01:59,550 that goes across the entire domain, 59 59 00:01:59,550 --> 00:02:00,600 so it's much easier for you 60 60 00:02:00,600 --> 00:02:02,880 to change those credentials as needed. 61 61 00:02:02,880 --> 00:02:05,430 Another thing you have to think about is ports. 62 62 00:02:05,430 --> 00:02:07,560 If you're going to start opening ports for scanning, 63 63 00:02:07,560 --> 00:02:10,380 this is sometimes needed, so you can actually do your scans, 64 64 00:02:10,380 --> 00:02:13,170 but you're also increasing your network's attack surface, 65 65 00:02:13,170 --> 00:02:14,700 because the more ports are open, 66 66 00:02:14,700 --> 00:02:16,830 that means the more bad things can happen, 67 67 00:02:16,830 --> 00:02:18,420 so you want to make sure you're thinking about that 68 68 00:02:18,420 --> 00:02:20,130 and weighing those risks. 69 69 00:02:20,130 --> 00:02:21,540 Another way that we can mitigate this 70 70 00:02:21,540 --> 00:02:23,970 is by configuring static IP addresses. 71 71 00:02:23,970 --> 00:02:27,090 If we configure static IP addresses for my scanning servers, 72 72 00:02:27,090 --> 00:02:30,030 this allows me to set up the right ACLs through the firewall 73 73 00:02:30,030 --> 00:02:32,460 and open up ports directly for those servers 74 74 00:02:32,460 --> 00:02:35,580 and those IPs only instead of opening it up for everybody. 75 75 00:02:35,580 --> 00:02:38,220 This can help you minimize the network attack surface. 76 76 00:02:38,220 --> 00:02:40,650 So again, this is all about risk versus reward 77 77 00:02:40,650 --> 00:02:42,060 and risk mitigation, 78 78 00:02:42,060 --> 00:02:44,970 and by taking these things into account, you can make sure 79 79 00:02:44,970 --> 00:02:47,190 that you're going to be scanning more effectively, 80 80 00:02:47,190 --> 00:02:49,413 more efficiently, and more securely.